Splunk Inc (SPLK) 2016 Q1 法說會逐字稿

Good day, ladies and gentlemen, and welcome to the Splunk Incorporated first-quarter 2016 financial results conference call.

(Operator Instructions)

As a reminder, today's call is being recorded. I would now like to turn the call over to Mr. Ken Tinsley, Vice President -- Investor Relations and corporate Treasurer. Please go ahead.

Great, thank you, Nicholas, and good afternoon, everyone. With me on the call today are Splunk's CEO, Godfrey Sullivan; CFO, Dave Conte; Head of Worldwide Field Operations, Doug Merritt; and Head of Security Markets, Haiyan Song. Our press release was issued after the close of market today, and was posted on our website. This conference call is being broadcast live via webcast and following the call, an audio replay will be available on our website.

On this call, we will be making forward-looking statements including financial guidance and expectations for our second-quarter and FY16; transaction, product, and services mix; investments in international operations and expected growth in international business; planned investments, including products, services, sales, and facilities; and market and use case opportunities. These statements reflect our best judgment based on factors currently known to us, and actual events or results may differ materially.

Please refer to documents we file with the SEC, including the Form 8-K filed with today's press release. Those documents contain risks and uncertainties and other factors that may cause our actual results to differ from those contained in our forward-looking statements. These forward-looking statements are being made as of today, and we disclaim any obligation to update or revise these statements. If this call is reviewed after today, the information presented during this call may not contain current or accurate information.

We will also discuss non-GAAP financial measures, which are not prepared in accordance with Generally Accepted Accounting Principles. A reconciliation of GAAP and non-GAAP results is provided in the press release, and on our website.

With that, let me turn it over to Godfrey.

Thanks, Ken. Hello, everyone. I'm happy to report a strong start to the year.

Total revenues were $125.7 million, a 46% increase over last year. We welcomed more than 450 new customers to the Splunk family, and now have more than 9,500 customers worldwide. It's now been about three years since our IPO, and sometimes to look forward, it's better to look back at our journey thus far.

In the year prior to the IPO, we put posters in all of our offices with a single message: Mile 3. That message to our employees was that our IPO was not a destination, but just the Mile 3 marker on the long run to building a lasting company and brand. The day after the IPO, we took down all the Mile 3 posters and put up our Mile 6 poster with our corporate initiatives. And just last month, three years later, we tore down the Mile 6 posters and replaced them with Mile 8.

The Mile 8 poster has four words on it: enterprise, partners, solutions, and cloud. These words represent the core initiatives that we're pursuing on behalf of our customers.

Today, I would like to spend a few minutes on these initiatives, and also to describe how we've organized the Company to achieve them. The first word is enterprise. It means the scale and quality of our products. It means building an enterprise platform that can drive multiple use cases. It means making it easy for developers to build apps. Enterprise also reflects our customers' needs, and our investments in technical resources, that drive customer success and adoption.

Partners reflects our global ecosystem of resellers, developers, and our technical alliances. All are critical to our Company growth and customer success.

Solutions means apps, content, and driving insights and business outcomes for our customers. Splunk is not just about indexing and searching machine data. We are becoming a solutions company, a solutions company that is supported by an enterprise grade platform, with apps that we build and our partners build.

Cloud. This may seem obvious, but here it means cloud first. That is designing everything we do to be easy, to be offered as a service, and to provide even shorter development cycles for our customers -- deployment cycles, my pardon. We offer a unique combination of cloud, on-prem or a hybrid of those two roles, and our customers really appreciate and value that approach.

These four words say a lot about our next phase of growth, and true to Splunk's open culture, we publish them for everyone to see. Just like Mile 3 and Mile 6, Mile 8 is a multi-year run ahead of us, and we've organized our exec team to better drive these initiatives. Guido Schroeder and the core development team are building the enterprise grade foundation. In Q1, the product teams shipped version one of Splunk Light, rolled out Splunk Cloud internationally, and released new versions of the app for enterprise security, Mint, and an app for Stream.

On the partner side, Emilio Umeoka is driving our programs for our go-to-market partners. Stephen Sorkin is building the developer tools and programs. We now have more than 700 apps on Splunkbase, and a new framework to help developers build apps faster.

Solutions. Our core use cases are well-known: app dev, IT ops, security, compliance, analytics, and IoT. To achieve our goals, we have created exec positions to drive these markets. We kicked off this initiative with the Security Market Group, and Haiyan Song is shaping our vision, strategies, and products for that market. We're coming off a strong showing at RSA, and Haiyan will brief you later on this call.

Next, we created the ITOA market group with Rick Fitz leading that team. He's also leading our efforts for mobile.

I should have Rick here to defend himself, but in his absence, I'm happy to report that we had a really strong Q1 for IT operations. The majority of our large transactions were for IT ops use cases. We also shipped the pre-release of our IT service intelligence app, and customer feedback has been outstanding. We expect to launch this app at Conf, and I look forward to showing to you then.

Last quarter, I mentioned that we would focus next on analytics solutions, and that I had started a formal search for this position. I'm happy to report that we've filled that position. Snehal Antani has just joined Splunk as our CTO, coming to us from GE Capital.

Snehal will also become our market group leader for business analytics and IoT use cases. Many of you will recall Snehal's presentation at Conf last year, where his message of continuous app development was a hit with our customer. Snehal has a strong background in building apps for commercial analytics, and is uniquely qualified to fill both roles of CTO and market group for analytics.

On to cloud. Marc Olesen is driving our Cloud business, and has built a strong team. Our Q1 results show continued acceleration, and excluding the very large transactions, we doubled our bookings from just two quarters ago.

Customers want to spend their budgets on software and training to achieve business results. They're less interested in managing the underlying kit, and they are delighted with the speed and ROI of Splunk Cloud. These four initiatives reflect a large and growing TAM. Our field organization is doing a fabulous job of taking all of these products to market.

Our global field teams, which represent about half of our headcount, are led by Doug Merritt. That includes sales, professional services, customer success, and our partner teams. Doug's here today to give you more color on our results and customer success.

Given the size of our TAM, and our ongoing penetration of new markets, my goal for these earnings calls is to give you increasing transparency into these initiatives. Not only the milestones, but also exposure to the execs who are leading them, and hopefully this will be as much fun for you as it is for me. Today, we will cover security and field operations. In future calls, you'll hear updates from cloud, IT operations and more.

First up, Haiyan Song, who is coming off another impressive quarter in the security market. Haiyan?

Thanks, Godfrey. In Q1, we continued to strengthen our role at the nerve center for security. Our ecosystem of partners is growing rapidly.

It was evident at this year's RSA conference, as our presence went well beyond the Splunk group. We presented alongside key partners like Palo Alto Networks, FireEye, Qualys and Tripwire, about the importance of security analytics. We led discussions with cybersecurity thought leaders in both the public and private sector, on the need for a well-orchestrated security solutions stack.

Splunk customer Jonathan Jowers, the CISO of SAIC, presented to a standing room only theater and talked about continuous breach response, and how Splunk is their security intelligence platform for an analytics-enabled SoC. We made two exciting announcements. A new release of the Splunk app for Enterprise Security, which continues its triple-digit year-over-year growth. In Q1, we booked our first seven-figure order solely for ES.

We also announced the second Splunk Aptitude contest, to drive community-led innovation in security. A top prize of $100,000 will be awarded to the best app for insider threat and fraud detection.

We showcased actionable intelligence, by jointly developing and releasing the Verizon DBIR app for Splunk, on the heels of Verizon's release of the 2015 data breach investigations report. And we capped RSA conference with Splunk Enterprise winning the best fraud prevention solution at the SC Awards. Fraud detection, just like breach analysis, continues to be a growing use case for Splunk. Or a customer, Surescripts standardized on Splunk software to crack down on healthcare fraud, by analyzing billions of electronic prescriptions and other health data transactions from doctors, pharmacies, and health plans.

High-profile breaches are a continuing business driver, leading both to reactive and proactive opportunities across all industries. In public sector, we could say we helped to defend the defenders. [Northern Command], a new customer, is in command and control of DoD's homeland defense efforts and selected Splunk Enterprise and ES to replace an existing legacy SIM. Splunk is used for both security and IT op use cases.

And a large federal agency selected the Splunk App for Stream in Q1, to leverage wire data to support security efforts, and to mitigate the risk of insider threats, by alerting the agency when sensitive information is being transmitted, and ensuring traffic and user activity from the network are trustworthy.

One final trend worth noting is the continued momentum from our customers selecting Splunk Cloud with ES for security. The City of Los Angeles and Okta are among the customers selecting Cloud plus ES this quarter. I am proud of the build-out of our security ecosystem and the results we have delivered thus far. And we look forward to continuing to innovate and expand our security solutions for our customers.

Now, over to Doug.

Thank you, Haiyan. Enterprise is the first pillar of our Mile 8 initiatives. As a reminder, enterprise means the scale and quality of our products, and reflects our investments in technical resources that drive customer success and adoption, with EAAs being a key indicator of this adoption.

You will recall we announced a new program in February to allow customers of any size to purchase unlimited licenses, with fixed predictable costs. Sony PlayStation Network signed an EAA in Q1 for Splunk Enterprise. They also purchased Enterprise Security and Hunk.

Our longtime customer, Adobe, also signed an EAA. This is the latest multi-year adoption story for Adobe. We also closed an EAA with Partners Healthcare to standardize on Splunk Enterprise. They also bought the Splunk application for Microsoft Exchange.

These are all examples of customers who, over a period of years, have moved from a single-department purchase to cross-departmental usage, to standardizing on Splunk. And they demonstrate the additive value of consuming multiple products from Splunk.

Now onto to our partners, another one of the key pillars of our Mile 8 initiatives. We are tightly focused on global systems integrators, MSPs, strategic technology partners, and of course, the channel. In Q1, we announced a distribution agreement with Arrow Electronics for North America, and are working with CDW on a go-to-market for Splunk Light.

We also rolled out our Partner Plus program at partner kickoffs around the world. The program has already been named a Channel Reseller News five-star partner program. We continue to drive strategic technology partners. Examples of execution are the co-selling momentum with our partner Syncsort, and joint marketing initiatives with Palo Alto Networks.

And we expanded our strategic alliance with Amazon Web Services by announcing the international availability of Splunk Cloud on AWS. Splunk Cloud is now available through nine AWS global regions, and early results from our international launch are promising. Sophos in the UK uses Splunk Cloud for analytics to support its security operations center. Katana1 out of Australia relies on Splunk Cloud as the backbone for their marketing analytics solution. And Polycom is using Splunk Cloud across their global operations to drive visibility across IT in their services and business centers.

Domestically, Splunk Cloud wins include AOL, who signed up for large terabyte Splunk Cloud instance for real-time performance monitoring, log analysis, and dev ops. The City of Los Angeles purchased Splunk Cloud and the App for Enterprise Security to correlate cyber threat information with several other governments, and monitor and analyze network traffic to identify discrepancies that indicate malicious attacks. One of our largest transactions for the quarter was a seven-figure order for a customer who was moving 90% of all data to AWS and is turning to Splunk for enterprise assurance and transparency.

In addition to our international cloud expansion, we're also pleased with how adoption and our new pricing programs are spreading globally. Swisscom, a long-standing Splunk customer, signed a large transaction to build a strategic data platform with Splunk. In addition, we have transactions with Saudi Arabian Airlines, SIX Swiss Exchange, Laing O'Rourke in Australia, Sky Brasil, and Measat Broadcast Network Systems in Malaysia. Interestingly enough, Measat will be using Splunk to gain operational intelligence from their pay television service.

Haiyan already covered the security use cases. We also had a great quarter for IT operations. Let me give you a few examples. Bloomberg is a longtime Splunk customer, and increased their investment in Splunk Enterprise for IT ops and security. And the Centers for Medicare and Medicaid Services, an agency within the Department of Health and Human Services, committed to a large expansion of Splunk Enterprise to help keep Healthcare.gov online, and ensure that Americans were able to sign up for healthcare.

On to business analytics. We had significant wins in this market segment. Thomson Reuters upgraded their Splunk license to analyze client usage trends for income securities, derivatives, and bank loans. Shazam is a longtime customer, and expanded their use of Splunk for business analytics dashboards, with new and current user trends in real-time for better targeting.

And as always, some of the best stories come from the Internet of Things. A great IoT story from Splunk Live Zurich came from Graphmasters, a German customer. The Company is behind a new navigation app, which helps drivers map their trips. Splunk Enterprise helped Graphmasters correlate data from traffic feeds, and suggests the quickest route at any time. And in Splunk Light Hong Kong, the Hong Kong Marine department shared its use of Splunk to keep traffic jams from happening in their harbor. By leveraging Splunk for radar and vessel identifier data, the department monitors shipping vessels as they enter, dock, and exit.

In summary, it was a good quarter on many dimensions: EAA execution, partner expansion, Cloud, and market solutions. Now, back to you, Godfrey.

Thanks, Doug and Haiyan. The diversity of customer stories is always an inspiration for our employees, and those stories just keep getting better. I recently attended Splunk Lives in DC and London. Great customer presentations as always.

In that spirit, I'm delighted to tell you that we've created a new section on our website that holds most of the customer presentations by city. If you ever want to see the breadth of our market opportunity, or just a good old-fashioned shot of adrenaline, go check out these great customer presentations at SplunkLive.com from customers like Social Security Administration, Ticketmaster, and DirecTV, to name just a few.

In closing, I'd like to thank everyone who works at Splunk, after we were named for the eighth consecutive year as one of the best places to work in the Bay Area. Now, let me turn the call over to Dave Conte.

Thanks, Godfrey. Good afternoon, everyone. Thanks for joining the call. Q1 was a strong quarter, and a solid start to FY16, and we're pleased with our results.

First-quarter revenues were $125.7 million, a 46% increase over Q1 of last year. License revenues grew 40% over last year, totaling $71.9 million. Once again, in Q1, more than 70% of our license bookings came from existing customers. We continued to see about two-thirds of our upsells coming from horizontal expansions into new use cases.

We added over 450 new customers in the quarter, and recorded 226 orders greater than $100,000. Consistent with our expectations, the ratable mix continues to vary substantially quarter to quarter. With the impact from the seven-figure Cloud transaction Doug described earlier, as well as the overall strength of our Cloud business, our Q1 ratable mix was 43%. Given Q1 is our seasonally lowest bookings quarter, we still expect our full-year ratable mix to range between 30% and 40%.

In Q1, international operations represented approximately 24% of total revenues, consistent with previous levels, and comparable on a year-over-year basis. We will continue to make investments in our international business, and look forward to continued growth and global expansion. Our education and professional services represented 8% of revenue in Q1, in the range of prior and expected levels of between 5% and 10%. Once again, remember, since we generally recognize revenues on services when they are delivered in full, services bookings typically do not flow through the balance sheet as deferred revenue.

Turning to margins, which are all non-GAAP. Q1 overall gross margin was 88%, consistent with Q1 last year and our expectations. Operating loss was about $1 million, representing a negative margin of approximately 1%. Q1 net loss was also about $1 million, and EPS was a negative $0.01 per share, based on a weighted average share count of 124.5 million shares.

Cash flow from operations was $28.6 million. Free cash flow was about $22 million, and we ended the quarter with just over $1 billion in total cash and investments.

Now, looking forward to the rest of the year, we expect Q2 total revenues of between $138 million and $140 million, with a 1% to 2% positive operating margin.

With our Q1 performance and our Q2 outlook, we now expect total revenues for the year to range between $610 million and $614 million, up from our prior guidance of approximately $600 million. Remember that we denominate revenue globally in US dollars, and therefore have no foreign exchange exposure to our revenue line.

As we continue to increase our investments in market groups, product teams, the field, and Splunk Cloud, we expect to generate positive non-GAAP operating margins of between 2% and 3% for the full year, consistent with last year's level and our prior expectation. Recall last quarter that I said over the medium-term, our operating margin targets will include the impact of a gradual 1 to 2 point increase in the cost of services, to reflect the impact of ramping our Cloud business.

Additionally, you can expect that we will continue expanding our service capabilities, tailored toward the use cases and solutions that align with our market group focus. As we have said in the past, customers who consume our services have a higher likelihood to also deploy more of our software over time, so we're happy to offer those additional capabilities.

Remember, since we expect to be profitable on a non-GAAP basis for the balance of the year, for your EPS calculations, you should use a fully diluted share count of approximately 132 million shares in Q2, which will accrete about 2 million shares per quarter thereafter.

We remain committed to running the business on a positive operating cash flow basis, and continue to expect that full-year operating cash flow will be approximately 20% of total revenues, with the quarterly levels following the trend we have seen over the past several years. As I mentioned on our last call, FY16 will be a higher than typical CapEx year for us, as we expect the bulk of our San Francisco headquarters build-out costs to be incurred this year.

When combined with global facility expansions to accommodate our growing employee base, we're planning for approximately $50 million in total CapEx this year. Last quarter, I said this CapEx would be weighted about $20 million in the first half, and $30 million in the second. Based on now that San Francisco project is tracking specifically, our current estimate is now about $12 million in the first half, and $38 million in the second.

In closing, our team continues to execute on our mission to deliver exceptional value to our customers, and we're committed to continuing investments in our products, solutions, and overall global reach. Q1 was solid, and I'm enthusiastic about our outlook for the remainder of FY16.

Thanks much for your time and interest. With that, we will open it up for questions.

(Operator Instructions)

Brent Thill, UBS.

I know the EAA program is fairly new. I'm curious if you could give us more input in terms what you're seeing. I know Doug mentioned Adobe and Sony, but maybe a little more color. And then also for Doug, if you could maybe just chat about your go-to-market strategy for the year. Did you make any tweaks or changes to the sales force go-to-market model for Q1 for the fiscal year?

I'll take -- Doug is swallowing some cough syrup, so I'll take the first half of the question, and he'll come in for the second. Yes, we just rolled out the EAA program at the end of February to the field organization at our sales kickoff, and of course, they've been out taking it to selected customers. As Doug mentioned in the prepared, typically a customer goes from departmental -- over a period of years, goes from departmental to multi departmental, and at that point of time that's when they're more interested in standardizing on a large-scale license.

So I think the combination of it's early in the rollout phase, plus it takes some customers some years of experience to get to the place where that's really an appropriate thing for them to do. I would call it very early stage. We have just -- think of it having just rolled it out and some customers now getting an explanation of it. So I think over the next several quarters, it'll be a good opportunity for us to give you more feedback, because the sales cycles on these things are not instantaneous. But the reaction to it has been quite positive.

Second half of the question, in terms of changes in Q1 or near term to the go-to-market model, Doug, any comment on that?

Thanks, Godfrey. The core of the go-to-market remains the same, Brent, but one of the bigger shifts that we've made, or I guess one of the more explicit shifts, was leveraging the success we saw in the Americas with effective sales segmentation between larger, medium, and smaller accounts. We have reflected that throughout Q1 into our major countries internationally with the invocation of majors and enterprise segment, or larger and medium large accounts within those countries. And I think we're seeing some good positive effects from that move.

Great. Thank you.

Keith Weiss, Morgan Stanley.

Excellent. Thank you guys and very nice quarter. There's been lot of discussion amongst the investor community about the competitive environment around Splunk, and I think it comes from two sides. One from the domain expertise competitors, so to say like an ArcSight, an HP in the security space; and then also from the open source community, particularly with the ELK Stack and what people are doing around Hadoop.

I was wondering if you could comment on whether you're seeing any change yourself, what you're seeing in the marketplace. Are you seeing open source becoming more competitive? Are you getting into more engagements with the domain experts like an ArcSight within HP? And how are your win rates holding up against those types of competitors?

So thanks for the comments, and happy to address that. I don't think there was any change in the competitive landscape in Q1. Splunk's competitive landscape has always been, when it's a use case, security or infrastructure or analytic -- when it's a use case, which most of them are, it's always about who has a better solution, and how quickly can it provide ROI.

And we're in fantastic shape there. Most of our competitors only do that very narrow vertical solution, and we usually have the advantage of saying, we do that use case, and when you get the data into Splunk, you can then solve a lot of other departmental use cases off of that same data. So there's nothing we like better in a competitive landscape situation than to come up against a vertical-use-case-only company -- you've already named a couple of names -- because the flexibility of our system and the speed and time to successful deployment, and how quickly you can expand to other use cases, is a huge advantage, and it shows up in very high win rates globally. So, couldn't be happier about that.

There's always -- then I think about customers who either have a bias to build or bias to buy. And if you look at enterprise software over the many, many years I've been in this business, there have been some fairly steady percentages between the percentage of customers who want to buy commercial off-the-shelf software, because they don't want to build anything, and that's about 60% of total spend; and about 40% is of customers who are using a whole variety of build technologies to actually build custom enterprise applications.

So you have to look at the market through those two lenses, and say which customer type is it? If it's a customer who wants to buy software and not build it, the open-source thing never comes up. And the customers who have a tendency to build, the banks would be a good example, building big custom enterprise apps, often large development staffs and a high propensity to build things, they will always go look at the next open-source technology, to say is that something that provides value.

But when you get there, Hadoop and ELK are two very different animals. So Hadoop really good at cheap batch storage, ELK really good at solving very narrow questions, but you have to apply about five times the amount of hardware to get it to work. And the reason for that is, because it parses the data ahead of time at read and write time, and then you have to create key value pairs, it's custom development all the way just to answer each question. Well, the creating key value pairs causes an explosion in data, which is why you need five times more hardware to run it.

And you've only narrowed -- answered a narrow question. Every time you want to add a new question or add a new data source or source types, you have to get the developers back involved to create more key value pairs, and custom code all that stuff.

So it's really expensive. I know everybody says it's free. It's really expensive to build on ELK both from a hardware standpoint, storage, and cost of ownership and maintenance, and it's not a very flexible system. So there's no secret as to why it's been really good at documents and weblogs over the years, Web analytics as its primary use case, and outside of documents. But it hasn't done very well in terms of going into the types of multi-source -- multi-source type, multi question. The flexibility that we provide, and how quickly we deploy, is something they simply can't touch.

So we have a lot of customers who wander off and try to build that stuff, and they come back bruised and bloody and say, boy, that was hard, and we didn't get very far. And every time we wanted to make a change, we had to go back in and open up the system.

So go back to the original lens. There are customers who want to buy software, because they don't want to build stuff, and we never see them. And it's only really in the accounts that have a high propensity to build where this stuff comes up, and they usually wander off in the woods for a while and then they come back.

Excellent. Thank you very much.

Raimo Lenschow, Barclays.

Thanks, and congrats on up great first quarter. Two quick ones. First if you think about Cloud and how customers are thinking about Cloud, can you talk a little bit about the evolution of that market? Initially, it was all about like Cloud apps and then you add Splunk on it. But from the conversations I have, it feels like it's getting broader and people are taking on-premise stuff into the Cloud.

Can you just say what you see there, and is that something that excites you? And then since we talked about security, a lot of these things at RSA, a lot of the messages there was that a lot vendors started on analytics, and it's not the same. I see your progress there, but how do you think about that? Is just that confirming use case, but is that long-term a competitive threat for you? Thank you.

I will reverse course on the questions, so thank you for your comments. I've been going to RSA for a number of years now, six or seven years now, and Haiyan twice that long or more. And it's so funny that five years ago all the booth signs said SIM and we were the only ones talking about security analytics. And now if you go to RSA the word SIM has completely disappeared, and everybody's talking about security analytics. So I feel like the market is coming to us in a big way, and so I get a big charge out of watching that whole thing pivot. I'm sure Haiyan will have a much more articulate answer to that then I will, but that's my two cents on it. Haiyan, do you care to go further?

Sure. You asked about, do we see that as a competitive threat coming in. We actually think the other way around.

Like Godfrey just talked about, we like the market. And what we have built as a platform and solution is really for our customers to use the big data and analytics capabilities to gain visibility and insight. And no other company that I know has that holistic view of all the data from the enterprise, and has that particular ability to go across the silos to bring that insight for the business. Security is no longer an IT-related issue, it's actually a business-related issue, so that holistic view is very important.

To go back to the Cloud question, Doug talked about one of our large orders for the quarter was actually a customer who was moving -- it was a dev ops led initiative that was led by the developers of the company. They were trying to move their entire stack -- apps, infrastructure, and storage -- all to the Cloud. So that was an unusual customer, who's saying, let's just go all Cloud.

But in that case, when you're moving all that to the Cloud, you have to have Splunk there. You effectively have all those same issues you were trying to monitor and manage and analyze on prem, you just happen to have them somewhere else. So as those types of migrations occur, we're a natural part of that architecture going in.

What actually happens more often than that is that a customer who has most of their activity on prem, they identify an app or a business initiative, or a unit of some kind, and they say, let's do that thing in the Cloud. So it's usually a combination of a lot of stuff on prem and a new thing on the Cloud. But they want to be able to traverse both environments, so that our ability to provide a hybrid search, our ability to provide unified analysis, regardless of whether your app is in the Cloud or you have brother and sister apps on prem -- it's a huge competitive advantage for us. We're really the only company in this space that can do both. So, yes, that's what we see most.

Perfect. Thank you.

Brian White, Cantor Fitzgerald.

Godfrey, just following up on the Cloud question there. How important is this to expand with AWS into -- it looks like nine -- you'll be in total nine global regions for that business. And could you just remind us how many Cloud partners do you have today? Is it just AWS? Are there other Cloud partners? If it is AWS only, are you going to expand that Cloud network? Thank you.

Yes, we are writing exclusively to the AWS Cloud stack, and we're pretty happy about that. We participated in their global launch, so Marc Olesen was running around the world with them as part of their presentations, to launch the international instances. So I think there's a massive market opportunity to help international customers.

I was hearing about interest from customers and AWS in Australia as early as I was in the US. I think there's opportunity for us to go capture, and it's a long time before we can run out of that opportunity. So we're pretty excited about the relationship, and the ability to go to market with them. I think they have, what, five times the market share of the number two competitor, so it's a great partnership to have. We're really happy about it.

And Godfrey, are there any metrics to track how the Cloud business is trending, either customers or growth rates, percentage of revenue?

I will turn that over to the grouch, Conte -- I mean our CFO, Conte.

(laughter) What you can hear in the background is Doug choking on all the Cloud pipeline that we're dealing with. Unfortunately, Doug is not feeling so well.

In terms of Cloud, we're certainly pleased with where we are. In terms of its contribution today, particularly to revenue, it's de minimis.

We've got a lot of momentum in terms of number of transactions. We specifically call out, we did another seven-figure order, one of our largest in the quarter in the Cloud. So the scalability that we provide to those customers is starting to show in transactions. We'll get further down the road in terms of track record, and provide you what we think are the right reporting metrics to demonstrate how we're doing in terms of Cloud. But overall, we're really happy with that momentum.

And to just pile onto Godfrey's earlier point, the differentiation about our ability to deliver a hybrid environment between Cloud and on prem is really important, so we see a number of our existing on prem customers also deploying Splunk in the Cloud. Sometimes, there's a transaction that includes both components, which muddies the waters a little bit in terms of your question, like how are you doing, what metrics that you have? Again, as we get more miles down the road, we'll come back and give you some insight.

We'll certainly have a presentation on it at Conf, so I encourage everybody to be up there for it.

Okay. Thanks a lot. Great quarter.

Phil Winslow, Credit Suisse.

Congrats on another great quarter. I've often described Splunk as the Grateful Dead of big data. Nobody does what you do, the way you do it. Kind of along those lines, when you think about that platform, the way you do it, and two of those initiatives you laid out, solutions and partners, how do you delineate about how you want to move up the stack, so to speak, and offer yourselves as applications, versus find partners for it?

In some of the moving up stack solutions, on top of that platform sort of a way in your mind to get the flywheel going to also attract partners, hey, see what I can do on this? Maybe you can do something else and get that virtuous cycle going of applications and platform?

Exactly, Phil. So thanks for the compliment on the quarter. Every data engine over time becomes an engine on which applications and solutions are built. That's just the way markets evolve, and the money goes there as well.

And you'd be surprised how many customers start a conversation with us saying, I have this business requirement. They don't say, I wish you would come in and analyze my machine data for me, or can you ingest our logs? They actually have a business problem they are trying to solve, and that's most often represented by an app or a solution of some kind.

So we need to do two things. One is, we need to build our own solutions for the core markets where you have to have that solution to compete with a whole product. And the second thing we need is to develop and evangelize, and help our partners go get those solutions that we can't possibly hope to cover.

So if security is a good example, I think it was five or six years ago that we actually purchased Enterprise Security, the app from a partner, and over the last five years have built it into a really core part of our offerings. Because you can't really compete in the security market as a serious player unless you have the combination of the engine and the app. That's kind of a minimum component to compete. But the two of them together, Gartner says that equals 97% of what they see as a world-class SIM. So it really is a market that evolves through a combination of the platform, plus the solutions that are appropriate for a customer; and our opportunity long-term is to do just that.

And when customers come to us asking us to put their stuff, whatever stuff is, in the Cloud, it's typically a solution of some kind. It's an application that's doing a job, and we're a part of that initiative. So anyway, a long answer to a short question.

Yes it's important for us to become a solutions company, and as we do so, those solutions that are not what we build ourselves are a perfect opportunity to go build a partner ecosystem and Haiyan is trying to correct me on something. Haiyan, go ahead

I just wanted to add, so if you take security, it's actually a good example of how it takes a whole suite of solutions to provide a complete security solution stack to a customer. So we have ES, and together from our ecosystem partners, they have built great apps like Palo Alto Network has built an app that not only helped their customers view and analyze their data inside Splunk, but also having the ability to take the intelligence derived from it, and actually take actions on to their appliances. So those are great examples of why it takes a whole community and a village to provide the best solutions to our customers.

Great, thanks.

Dan Ives, FBR Capital Markets.

Great, this is Jim Moore in for Dan Ives. Good quarter, guys. On the security side again, could you talk about what you are seeing on the federal front? You talked about some government deals and just the increased focus from their end, and how this might be shaping spending over the coming quarters.

As I mentioned, we see great momentum in both public sector and private sector, and partly it's filled by all these high-profile breaches that we have seen in the last year or so. They continue to get a lot of momentum for two reasons. One is breach analysis is a big use case, and its continued to grow and insider threat is one of the top priorities for a lot of the federal agencies to understand what's happening inside their agency. We have doubled down on a lot of our investments in the public sector area, in terms of building government relationships and evangelizing. We definitely will continue to benefit from all the investment we're putting in that area.

Great. Thanks for taking the question.

Kash Rangan, Merrill Lynch.

Thanks I like Phil's musical analogy, but I will say you are the champions of big data. One thing that occurred to me is looking at the fairly significant trend that's happening, the rabble going from 45% to 42% -- actually, 25% to 43% on a year-over-year basis, that looks pretty massive. So judging by my rough back of the envelope calculations, this means three-year breakeven for a subscription versus license. Looks like the value of your business was up somewhere 80% to 85%. So clearly very impressive.

And also, your billings on a reported basis looks to have stayed course at 47%. But how am I to reconcile that with the fact that deferred revenues were flat, and we have typically seen that bump up nicely from Q4 to Q1? Obviously there is some strength beneath the reported metrics, that I'm trying to get a better handle on.

And secondly, what's your sales quota carrying headcount today, and where do you plan to end the year? That's it for me, thank you.

I don't know if I should say thanks Kash, or thanks Freddie. But as it relates to deferred, as I look back over the sequential change over the last number of years between Q4 and Q1, I think it's been pretty flat, Kash. And you can see you pointed out the calculator, the derived billings number grew in the upper 40th percentile, which you can see in the revenue line, where we over delivered in terms of our expectation.

And I repeatedly have the comment in my prepared remarks, just as a reminder that services and services bookings typically don't flow through the balance sheet, and it's an area that we think is really important in terms of getting customers to value, customers come back and deploy more of our software. And we're going to be doing more work around providing those types of services capabilities around our solutions that align with the market groups. So I think the composition and the geography of the bookings between the income statement and the balance sheet are actually positive and consistent with how we've had it in the past.

As it relates to quota carriers, we ended the quarter with 328 quota carriers in total. What we have done in the past, as we get to the middle of the year, we provide some type of guidance on where we think we will end the year in terms of total quota. Recall at .Conf last year, during the analyst session, I introduced the idea that our go-to-market and our overall field capacity is evolving. And it includes the impact of not just pure quota-carrying folks, but a lot of the channel investment that Doug has referred to before; as well as some of the specialists that we're adding to the field organization, that can go deliver the right amount of value to a customer that has a secure use case or an IT operations use case, or a business analytics use case.

When we look at our overall investment in the field, we're still digesting and working through, how do we think about overall field capacity and what's the right way to set that expectation with you all externally. And that's something that again, at .Conf last year, I committed we would come back with what is the right overall field capacity metric to think about. And I'm targeting .Conf for this year, so hopefully we will see all you guys there, and we'll be able to share some of that.

In summary, I think the best way to think about it is we're continuing to invest in our GTM teams, and you can see that, in terms of the allocation of expenses on the face of the income statement, where we've consistently provided, again on a non-GAAP basis, anywhere from 55% to 60% of revenue into sales and marketing. And I expect that to -- continue to see that as the allocation in terms of investment.

And if I may, why is the percentage of ratable expanding so dramatically? That is a big shift. What's going on in your end market and the way customers are buying?

I think, you mentioned the year-over-year comparison Q1 of last year was 25%, Q1 of this year was 43%, and it specifically ties into a very large Cloud-specific transaction, which is in that calculation. Momentum in the Cloud business overall, we're certainly pleased with having rolled out a formal program around EAAs, and Doug listed off a handful of examples of those customers. So we're enabling the customers with the structure that gives them the predictive economics that they need, and we're seeing those types of transactions materialize.

All of that feeds into what the percentage is. I think the last component, which I tried to articulate in prepared remarks, is Q1 is our seasonally lowest quarter. So when you have a large Cloud transaction in the numerator and the denominator, it can skew the percentage.

What we're committed to, and you guys know because I've updated the metric probably five times, as we see a trend line that says our full-year ratable percentage is increasing, then we're going to update that expectation. But again, even though last year we ended at a 45% of ratable in Q4, the overall full-year percentage was 38%. So inside of our current range, which is 30% to 40%, that's our expectation for this year.

Got it. Thanks so much.

Katherine Egbert, Piper Jaffray.

To follow up a bit more on that, can you talk about the revenue recognition, specifically on the EAAs, Dave? Are they ratable, or are they more up front? And also on given, if they are more ratable, and given that you're doing more in the Cloud, why isn't your ratable percentage going up for the year and forward?

Hey, Katherine. So a majority of adoption transactions I would characterize as ratable. But by definition, by default an EAA does not mean ratable.

Another clarification that I always like to throw in, when we talked about large transactions every quarter, those greater than $100,000, annually we report the number of seven-figure transactions. But it's important to note that every large order is not synonymous with an EAA. But to answer your question, a majority of EAAs would fall into the ratable category.

In terms of why isn't the percentage going up? Again, as we get further down into the year, if we see a sustained level of mix being higher than what is our current guidance at 30% to 40%, then we'll update that. But I can tell you that the way we have built our own model uses assumptions that are in that range.

Okay, and just to put a finer point on it, are EAAs that are ratable taking over from previous deals that were non-ratable? So is there a shift going on a little bit here?

What I see, if you think about the composition of our transactions, we have this growing number of large transactions. ASPs over time have been pretty consistent, and the only way you get a growing number of large transactions with consistent ASPs is a growing number of smaller transactions, as well. And Q4 was our largest number of transactions in our history, and we were pretty close to that in a seasonally low Q1, so I wouldn't say that the large ratable transactions are taking over for what would have otherwise been upfront transactions. Rather, as customers mature with us and get broader amounts of deployment, and ultimately standardize across the platform, those will tend to turn into ratable transactions. The entry-level point, those will tend to be perpetual or upfront.

Okay. That makes sense. And then just one last quick question. Can you give us EAA as a percentage of revenue in the quarter?

That's not a metric that we provide today. But if we think it's relevant in terms of how to build the model, then we'll provide it. When we build our own estimates around adoption transactions, and what that means in terms of flow into revenue, that's all part of our 30% to 40% mix range that's contemplated.

Okay, got it. Thanks, good job.

Walter Pritchard, Citigroup.

Not to beat this topic to death, David, but on the ratable, or on the EAA transactions, can you tell how many of those are -- have a term nature in them as opposed to a ratable but perpetual?

Sure, Walter. A majority of our enterprise adoption transactions are term transactions, or have a term element. What I mean by that is, some might be a straight term transaction, call it three years, a certain amount of capacity.

At the top end of our program, that's unlimited capacity. Others might be perpetual in nature that say, you own a certain amount of the software as a perpetual license. We're going to give you head room beyond that capacity for a period of time, i.e. a term, and when that term expires, you own what you own.

So this program that we rolled out last quarter, we talked mostly about the top end of that program, which is unlimited adoption transactions. Those are characterized as three-year terms. We have this headroom concept where, as I just mentioned, you can buy a perpetual license that has additional capacity available to you that you can keep if you deploy within a certain amount of time. And then we have an adoption bundle that is mostly a perpetual license that's wrapped around a set of services, and account management resources that are focused on ensuring a successful deployment on the adoption inside of the enterprise.

Great, and just one quick one on the product side. It sounded like ITON was a big driver this quarter, and I'm wondering, sometimes big deals drive those trends and they're rather lumpy. But do you contribute that success to anything specific on the product side, or anything you've done that might be repeatable? Do you look at that more as a product of lumpiness?

It's just a quarter to quarter situation. The security has been running along in the mid to high 30s. Over the last couple of quarters it was more like a third in Q1. But I think it's just more about pipeline and which customers, and what use cases and the like.

In Q4 a lot of the seven figure transactions were security, most of them or a big majority of them, and Q1, a lot of them were ops. The thing I'm most excited about is the IT service intelligence app that we're out in preview with right now. We have about 20 or 25 customers around the world that have actually installed it, and are using it, and the customer reaction to that's just been extraordinary. So I look forward getting three or four months more of pre-release testing at those large-scale customers so that we can launch it at Conf. So be sure be at Conf, if I haven't said that already on this call. We're going to have some exciting stuff to show.

Great, thanks.

Ed Maguire, CLSA.

This is Clarence Chen sitting in for Ed, thank you for taking our questions. Two quick ones. The first one, I'm wondering if you could comment on whether you see more customers switching between perpetual and term licenses recently, and if so, is there any reason behind it? And the second one is, I'm wondering if you could also elaborate a bit more on your expectations on the adoption curve of Splunk Light, as well as the expectation on the Arrow Electronics deal from March? Thank you.

So tell Ed that I'm upset he's not on the call. Tell him I want him to call me.

I will let him know.

The odd thing about whole term versus perpetual, and customers have an opinion about this stuff, and if they say, I want to take a lower price and set up an annual term service, and pay for capacity over a period of years with a term contract and not have a perpetual ownership of software, we do what they want them to do. So Cloud is impacting that to some degree, because there are more and more customers getting used to a subscription model, that hits OpEx and that goes against the traditional way that people brought enterprise software on a CapEx model. So there's been a shift going on in the business, and I'd say if I look at the way the wind direction is changing, I would say it's changing a little bit towards the OpEx model as opposed to the CapEx model, led by our good friends at salesforce and others who started that wave.

I think over the years as Dave has had to update our model how many times now? Four or five times, and continue to increase the percentage of our bookings that are treated in some sort of ratable way; I think it reflects the shift that's going on slowly in the marketplace. Cloud will exacerbate that, or at least add to it. I think that's going to go up, not down.

Got it. And then would you be able to also comment on the second one as well, in regard to the adoption for Splunk Light and the Arrow Electronics agreement?

Ask me that question again on the Q2 call. We just got the contract signed in late Q1, and we're doing training and all that sort of thing, early in the relationship there. It's probably better, I'd be better off to bring that back for Q2 question.

Understood, okay. Thank you very much, I appreciate it.

John DiFucci, Jefferies.

I'm on the road, I'm sorry about that. Question for Godfrey and Doug, I think. I'm just curious how you think this program to have technology specialists, and you had Haiyan speak today, to complement a more generalist sales force is going? You've got some experience now with this, and there's obviously demand. You guys continue to put up really good numbers and good momentum. Have you considered expanding the sales force more quickly now? It seems like you might be able to do something like that.

The last I saw Doug he was leaving the room chugging cough syrup, so he might be back in here to answer that question, but in the meantime, I'll take a swing at it for him. As we continue to invest in field resources overall, there's enormous competition for both sales capacity, as well as technical resources. As our customers get larger, they want more help from us in professional services and client architects, solutions specialist for market, use cases like security, so it's not quite so easy anymore just to add accounting execs and SCs and know that you have a unit of one.

A unit of one in the field anymore is more technical -- technically weighted than it used to be. So yes, I would like to expand revenue generation, that is quota-carrying capacity, as fast as we can inside of brother Conte's financial envelope, which is always a constraint to me, but I've learned to accommodate that. We have our hammer fights but we get along otherwise.

And inside that ability to invest as much as the financial envelope will allow is also a constraint called, is the market ready? It doesn't do good to put a lot of sales and/or technical resources into a territory, unless it's ready, unless it's a place where we feel like we can turn greenfield into something else. I think we're approaching it about the right way right now. We divide territories, or we invest in new countries, or we invest in new verticals, or we invest in new technical capacity based on where our analytics show us the market opportunity is. And I have to say at this moment, I feel like we're in pretty good balance.

I guess Godfrey, okay, that makes sense, but how would you gauge how that's going? There was a time, not long ago when you would hire sales people and it took them a long time to come up to speed because it's still a pretty sophisticated sale, there's a lot of different use cases, it's very technical. And then you said, listen, we're going to bring in technologists to supplement that, and maybe we can use sales people that aren't quite as technical, and it'll help them get up to speed more quickly.

Are you happy with how that has developed, or has that been slower, faster than you would have expected? Because when I see the numbers you put up, and listen, if you are going to invest for growth, you have to grow, right? We've seen companies invest for growth and not grow, that's not a good thing.

But frankly if it's out there and there's all these other companies and someone asked a question about competition, because everybody wants to be like Splunk, they want to be. There's companies that go out and say, we're like Splunk. Which is a great compliment, but most of the time, they're not like Splunk. Are you satisfied with that program, or I don't know if it's a program, that strategy?

Yes, so got it. I understand your question, and appreciate that. I would say that the one thing that is still an obstacle is the time it takes to ramp people. There's a lot more resource, Haiyan has a whole -- she has a lot of technical resource that's security specific across the globe now. We are in a lot better shape than we were a year or two ago in terms of being able to, in almost any country or any customer or POC or any competitive challenge and know that we have the field coverage plus we have the technical specialists on the security side, where we are a formidable competitor going into an opportunity. That part I feel massively good about, very satisfied with the strategy and the design.

The thing that actually hasn't changed very much as how long it takes to ramp new people coming into Splunk. The complexity of the marketplace, the complexity of all the data sources and the number of use types, the number of use cases, the number of differences between the types of problems customers are trying to solve is so diverse that it still takes a long time to learn; from hello, I just joined Splunk; to, I'm actually able to go and have a conversation with the customer about a variety of use cases, and actually build a pipeline. Actually build pipeline.

That's the thing that still takes some time, and I think to some degree, when Doug talked last quarter about it, he said we're not going to go into many new countries this year, we're really going to try to backfill and put more people in each country. That's still a big part of our plan of record, and we're executing against that. And one of the reasons we're doing that is because when you have this many use cases in this wide of a range of market opportunity, critical mass is a lot more important than breadth of coverage. So we're still pursuing that design point with as much conviction as we ever have. So I'm very satisfied with the strategy, but this marketplace is technical enough, complex enough and diverse enough that you can't just throw people in a territory and have them automatically generate pipeline. It's not quite that.

And John, we have talked over the years, that we are very conscious about the rate at which we bring folks on board, because hiring them is the easy piece. Getting them productive and setting them up for success, as Godfrey has just articulated is more art than science. So we want to be very thoughtful about the rate at which we bring people on, so that they're ultimately successful and can deliver for the customer. So that is not new for us, in terms of how we set our objectives, and ultimately make those investments at the rate which we invest.

Great, that all makes sense. Thanks, a lot. Dave, one quick question. Your renewal rate?

Renewal rate. The DiFucci org design is alive and well. The renewal rate again was well above 90% in the quarter. In fact, it was 94%. I think that's the eighth quarter in a row that it's been at 94%, and I think it was a call or two ago that we retired the metric, just because it was consistently at that 94% range or about 94%. So many quarters in a row that it was no longer really that interesting.

Well, it's still interesting to me. Thanks a lot. Take care.

Thank you. Ladies and gentlemen, this concludes today's Q&A session. I would like to turn the call back over to Ken Tinsley for closing remarks.

Okay, great, thanks, Nicholas. I appreciate your help today. And thanks, everyone, for your participation. As always, if you have any questions, we're available tonight if you need. Please give us a call. Thanks, and have a good evening.

Ladies and gentlemen, thank you for participation in today's conference. This does conclude the program and you may now disconnect. Have a good day, everyone.